Windows Process: winget adds new download source via 'source add' with IP/endpoint

title: "Windows Process: winget adds new download source via 'source add' with IP/endpoint"
id: 0dc7943d-c4a0-4805-b41b-c4575a508904
related:
  - id: 05ebafc8-7aa2-4bcd-a269-2aec93f9e842
    type: similar
  - id: 81a0ecb5-0a41-4ba1-b2ba-c944eb92bfa2
    type: similar
  - id: c15a46a0-07d4-4c87-b4b6-89207835a83b
    type: derived
status: test
description: This rule flags process executions of winget.exe where the command line includes both 'source ' and 'add ' and the specified source contains an IP-based endpoint. Adding new package sources can enable attackers to redirect installations to malicious content. The detection relies on Windows process creation telemetry, matching the executable name and parsing the command line for the relevant 'source add' activity and an IP address pattern.
references:
  - https://learn.microsoft.com/en-us/windows/package-manager/winget/source
  - https://github.com/nasbench/Misc-Research/tree/b9596e8109dcdb16ec353f316678927e507a5b8d/LOLBINs/Winget
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_winget_add_susp_custom_source.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-04-17
modified: 2023-12-04
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \winget.exe
    - OriginalFileName: winget.exe
  selection_cli:
    CommandLine|contains|all:
      - "source "
      - "add "
  selection_source_direct_ip:
    CommandLine|re: ://\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1